feat(security): allow calc and gradient functions. #13943
Conversation
Also includes support for # color notation in function arguments (common in gradient functions).
mprobst
added
area: security
| const SAFE_STYLE_VALUE = | ||
| new RegExp(`^(${VALUES}|(?:${TRANSFORMATION_FNS}|${COLOR_FNS})${FN_ARGS})$`, 'g'); | ||
| const GRADIENTS = '(?:repeating-)?(?:linear|radial)-gradient'; | ||
| const CSS3_FNS = '(?:calc|attr)'; |
There was a problem hiding this comment.
attr is a fun one: imagine something like <input type="password" value="secret" style="{{x}}"/>, do you think you're able to exfiltrate or at least display the value ?
I don't think you can for now on Chrome or Firefox, but https://developer.mozilla.org/en-US/docs/Web/CSS/attr says that "support for properties other than content is experimental". That means that very hypothetically, you could have:
<input type="embarassing" value="information" [style.background-image]="userSpecified"> with attr(value url), which is okayish according to MDN and leaks some information.
Realistically, and with the limitations of attr, it looks fine. Unless planets are wrongfully aligned, I don't see this causing issues. The web moving forward too fast might break these assumptions, so look out for CSS string concatenations if they ever happen :/
mprobst
added
action: merge
|
@mprobst please fix lint errors so that it can be merged. |
PR Close #13943 Also includes support for # color notation in function arguments (common in gradient functions).
PR Close angular#13943 Also includes support for # color notation in function arguments (common in gradient functions).
PR Close angular#13943 Also includes support for # color notation in function arguments (common in gradient functions).
|
This issue has been automatically locked due to inactivity. Read more about our automatic conversation locking policy. This action has been performed automatically by a bot. |
PR Close angular#13943 Also includes support for # color notation in function arguments (common in gradient functions).
Also includes support for # color notation in function arguments (common
in gradient functions).
Does this PR introduce a breaking change? (check one with "x")